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DETAILED ACTION 

Continued Examination Under 37 CFR 1.114 

1 . A request for continued examination under 37 CFR 1.114, including the fee set 
forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this 
application is eligible for continued examination under 37 CFR 1.114, and the fee set 
forth in 37 CFR 1 .17(e) has been timely paid, the finality of the previous Office action 
has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 23 June 
2009 has been entered. 

2. By the above submission, Claims 1 and 19 have been amended. New Claims 40 
and 41 have been added. No claims have been canceled. Claims 1, 2, 4-17, 19-23, 
25-35, 40, and 41 are currently pending in the present application. 

Response to Amendment 

3. The present amendment is not fully compliant with the requirements of 37 CFR 
1 .121 . In particular, Claims 1 , 2, 15, and 19 appear to have been amended without 
showing all changes made relative to the previous version as required by 37 CFR 
1.121(c)(2). More specifically, in Claim 1, line 7, the text "maintaining a state table on 
said computer" appears to have been replaced and now reads "said state table on said 
computer". In Claim 2, line 2, it appears that "portion" has been deleted after "header 
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message". In Claim 15, line 2, it appears that "SubType" was replaced by "Type". In 
Claim 19, line 7, it appears that the numeral "4" has been inserted at the end of the line. 
In each of the above cases, it appears that these changes were likely to be 
unintentional, and therefore, it has been assumed that these unmarked amendments 
were not intended but were due to clerical errors. Therefore, these portions of the 
claims have been treated as though they were unchanged from the previous versions of 
the claims (where amendments are clearly marked in independent Claims 1 and 19, 
however, these amendments have been considered and entered). Additionally, due to 
the unmarked amendments, Claims 2 and 15 appear to have incorrect status identifiers 
as set forth in 37 CFR 1.121 (c). Specifically, it appears that Claims 2 and 1 5 should 
have been labeled with the status identifier (Currently amended) instead of (Original) or 
(Previously presented), respectively; however, if the amendments were unintentional, as 
appears to be the case, then the current status identifiers would appear to be correct. 
4. However, because the present response appears to be a bona fide attempt to 
advance the prosecution of the present application, the amendments have been 
considered as though it were fully in compliance with the requirements of 37 CFR 1.121, 
and, as noted above, the unmarked amendments have been assumed to have been 
unintentional and those portions of the claims have been treated as though they were 
unchanged from the previous versions of the claims. In the next response, Applicant is 
required either to clearly state on the record that the amendments were unintentional 
and reinstate the previous claim language without markings if the amendments were 
unintentional or to provide amendments in the next response showing the changes 
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made relative to the previous version as required by 37 CFR 1.121 if the amendments 
were intended to be made. 

Response to Arguments 

5. Applicant's arguments filed 23 June 2009 have been fully considered but they are 
not persuasive. 

Regarding the rejection of Claims 1,2, 4-17, 19-23, and 25-35 under 35 U.S.C. 
103(a) as unpatentable over Macaulay, US Patent Application Publication 
2003/0135762, in view of Hrastar, US Patent 7042852, and with specific reference to 
independent Claims 1 and 19, Applicant asserts that "nothing in the art of record 
teaches or suggests" the new limitation in the independent claims of maintaining a state 
transition history for each of the mobile units (page 9 of the present response). 
Applicant's arguments fail to comply with 37 CFR 1 .1 1 1 (b) because they amount to a 
general allegation that the claims define a patentable invention without specifically 
pointing out how the language of the claims patentably distinguishes them from the 
references. In particular, Applicant provides no evidence or explanation in support of 
this assertion. Although the relevant portions were not previously cited, the Examiner 
submits that the combination of Macaulay and Hrastar does suggest this limitation. In 
particular, Macaulay discloses logging detailed data regarding the network, i.e. 
maintaining a history of the various mobile units in the network (see Macaulay, 
paragraphs 0043-0044, 0091 , where detailed network analysis is logged). In 
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combination with the disclosures in Hrastar of specific types of state data of the mobile 
units (Hrastar, column 29, lines 5-17, where state includes authentication status, 
address, etc), this suggests keeping a history of the states of the mobile units as 
claimed. 

Regarding new Claims 40 and 41, Applicant asserts that none of the references 
disclose or suggest a power management mode as a further parameter (pages 8-9 of 
the present response). Again, Applicant's arguments fail to comply with 37 
CFR 1.111 (b) because they amount to a general allegation that the claims define a 
patentable invention without specifically pointing out how the language of the claims 
patentably distinguishes them from the references; Applicant does not provide any 
explanation or evidence in support of this assertion. The Examiner submits that the 
combination of Macaulay and Hrastar does disclose a power management mode. In 
particular, both Macaulay and Hrastar refer frequently to the various IEEE 802.1 1 
standards (see Macaulay abstract and throughout; see Hrastar, for example, column 3, 
line 57-column 4, line 17, where the 802.11 standards are incorporated by reference). 
Power management mode is known to be one of the parameters that is defined by the 
802.1 1 standard (see section 1 1 .2 of the 802.1 1 standard, for example), and therefore it 
is included in the state data of the network (Hrastar, column 29, lines 5-17) and the 
detailed analysis that is logged by Macaulay (Macaulay, paragraphs 0043, 0044, 0091 ; 
see also paragraph 0107). 

Therefore, for the reasons detailed above, the Examiner maintains the rejection 
as set forth below. 
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Claim Objections 

6. Claims 8 and 26 are objected to because of the following informalities: 
Claims 8 and 26 each recite "a second WEP value"; it appears that, for 

consistency with the first WEP flag value earlier in the claims, this should read "a 
second WEP flag value". 

Appropriate correction is required. 

Claim Rejections - 35 USC §112 

7. The following is a quotation of the second paragraph of 35 U.S. C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

8. Claims 1,2, 4-17, 19-23, 25-35, 40, and 41 are rejected under 35 U.S.C. 112, 
second paragraph, as being indefinite for failing to particularly point out and distinctly 
claim the subject matter which applicant regards as the invention. 

Claim 1 recites "and maintaining a state transition history for each of said mobile 
units" in lines 10-11. It is not clear what the subject of this limitation is and/or what the 
limitation is intended to be coordinated with. This renders the claim indefinite. 

Claim 19 similarly recites "and maintaining a state transition history for each of 
said mobile units" in lines 11-12. It is not clear what the subject of this limitation is 
and/or what the limitation is intended to be coordinated with. This renders the claim 



Application/Control Number: 10/809,599 Page 7 

Art Unit: 2437 

indefinite. It is further noted that the latter portion of this limitation may have been 
intended to read "for each of said access points", noting that the state information in this 
claim is for the access points and not the mobile units (see lines 8-9 of the claim). 

Claims not specifically referred to above are rejected due to their dependence on 
a rejected base claim. 

Claim Rejections - 35 USC § 103 

9. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

10. Claims 1, 2, 4-17, 19-23, 25-35, 40, and 41 are rejected under 35 U.S.C. 103(a) 
as being unpatentable over Macaulay, US Patent Application Publication 
2003/0135762, in view of Hrastar, US Patent 7042852. 

In reference to Claim 1 , Macaulay discloses a method for detecting unauthorized 
attempts to access a wireless data communication system, where the method includes 
forwarding one or more packets received by an access point to a computer that 
compares the format of the packets to a format specified by a protocol (see paragraphs 
0045-0046 and 0095-0107; note also paragraphs 0032-0035 and 0042 where the 
wireless network is monitored), and signaling an alert if the packets deviate from the 
protocol specified format (see paragraphs 0049-0050). Macaulay further discloses 
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maintaining a history for the mobile units (see paragraphs 0043-0044, 0091 , where 
detailed network analysis is logged). However, Macaulay does not explicitly disclose 
maintaining a state table storing state information for the mobile units, where the state 
information is also used to signal an alert. 

Hrastar discloses a method in which a state table storing state information for 
mobile units is stored (column 28, line 64-column 29, line 4, where the data store 
includes a state data store and a station database; column 29, lines 5-17), where the 
state information includes at least a MAC address parameter, an authentication status 
parameter, and a further parameter unrelated to the MAC address parameter and 
authentication status parameter (column 29, lines 5-17, where the station database 
includes information including a device address, communications state, and other 
parameters, where the address is a MAC address, column 26, lines 41-46, the "state" 
corresponds to the claimed authentication status, and the timestamps and byte counts, 
for example, correspond to the claimed unrelated parameters), and an alert is signaled 
if packets deviate from the stored state information (column 30, lines 35-43). Therefore, 
it would have been obvious to one of ordinary skill in the art to modify the method of 
Macaulay to include state information, in order to enhance network security (Hrastar, 
column 5, lines 21-22). Further, in combination with the history/logging disclosed by 
Macaulay (Macaulay, paragraphs 0043-0044 and 0091), the inclusion of state 
information (Hrastar, column 28, line 64-column 29, line 17) would also suggest 
maintaining a history of the states of the mobile units, and therefore, it also would have 
been obvious to one of ordinary skill in the art to modify the method of Macaulay to 
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include a state history of the mobile units, in order to enhance network security (Hrastar, 
column 5, lines 21-22). 

In reference to Claim 2, Macaulay and Hrastar further disclose a header 
message portion and comparing the format of the header portion to the protocol 
specified format (see Macaulay, the table following paragraph 0094). 

In reference to Claim 4, Macaulay and Hrastar further disclose comparing format 
of a frame control field (see Macaulay, the table following paragraph 0094). 

In reference to Claims 5 and 6, Macaulay and Hrastar further disclose 
Management and Control frames (see Macaulay, the table following paragraph 0094; 
see also paragraph 0099). 

In reference to Claims 7 and 8, Macaulay and Hrastar further disclose comparing 
a WEP flag value (see Macaulay, paragraph 0104). 

In reference to Claim 9, Macaualay and Hrastar further disclose a protocol 
version (see, for example, Macaulay, paragraph 0083). 

In reference to Claims 10 and 1 1 , Macaulay and Hrastar further disclose source 
MAC addresses that are multicast and broadcast addresses (see Macaulay, paragraphs 
0124, 0127). 

In reference to Claims 12-15, 17, and 40, Macaulay and Hrastar further disclose 
monitoring for a possible denial of service attack (Macaulay, paragraph 0106) and that 
the packets may contain unsupported values and lengths (Macaulay, paragraph 0107, 
for example, where values in the 802.1 1 protocol that could be manipulated include 
Power Management, More Data, Type, and SubType fields) and that the state table 
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could include a power management mode (Macaulay, paragraph 0107, where the 
802.11 protocol includes Power Management; paragraph 0091, where detailed network 
analysis is logged; Hrastar, column 29, lines 5-17, regarding the state table itself; see 
also, column 3, line 57-column 4, line 17, where the 802.1 1 standards are incorporated 
by reference, and section 1 1 .2 of the 802.1 1 standard). 

In reference to Claim 16, Macaulay and Hrastar further disclose detecting a 
spoofed MAC address (Macaulay, paragraphs 0095, 0101). 

In reference to Claim 19, Macaulay discloses a method for detecting 
unauthorized attempts to access a wireless data communication system, where the 
method includes forwarding one or more packets received by a mobile unit to a 
computer that compares the format of the packets to a format specified by a protocol 
(see paragraphs 0045-0046 and 0095-0107; note also paragraphs 0032-0035 and 0042 
where the wireless network is monitored), and signaling an alert if the packets deviate 
from the protocol specified format (see paragraphs 0049-0050). Macaulay further 
discloses maintaining a history for the mobile units (see paragraphs 0043-0044, 0091 , 
where detailed network analysis is logged). However, Macaulay does not explicitly 
disclose maintaining a state table storing state information for the mobile units, where 
the state information is also used to signal an alert. 

Hrastar discloses a method in which a state table storing state information for 
mobile units is stored (column 28, line 64-column 29, line 4, where the data store 
includes a state data store and a station database; column 29, lines 12-17), where the 



Application/Control Number: 10/809,599 Page 1 1 

Art Unit: 2437 

state information includes at least a MAC address parameter, an authentication status 
parameter, and a further parameter unrelated to the MAC address parameter and 
authentication status parameter (column 29, lines 5-17, where the station database 
includes information including a device address, communications state, and other 
parameters, where the address is a MAC address, column 26, lines 41-46, the "state" 
corresponds to the claimed authentication status, and the timestamps and byte counts, 
for example, correspond to the claimed unrelated parameters), and an alert is signaled 
if packets deviate from the stored state information (column 30, lines 35-43). Therefore, 
it would have been obvious to one of ordinary skill in the art to modify the method of 
Macaulay to include state information, in order to enhance network security (Hrastar, 
column 5, lines 21-22). Further, in combination with the history/logging disclosed by 
Macaulay (Macaulay, paragraphs 0043-0044 and 0091), the inclusion of state 
information (Hrastar, column 28, line 64-column 29, line 17) would also suggest 
maintaining a history of the states of the mobile units, and therefore, it also would have 
been obvious to one of ordinary skill in the art to modify the method of Macaulay to 
include a state history of the mobile units, in order to enhance network security (Hrastar, 
column 5, lines 21-22). 

Claims 20-23, 25-35, and 41 recite limitations corresponding to and similar to 
those recited in Claims 2, 4-17, and 40, and are rejected by a similar rationale. 



Conclusion 
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Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Zachary A. Davis whose telephone number is (571 )272- 
3870. The examiner can normally be reached on weekdays 8:30-6:00, alternate 
Fridays off. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Emmanuel Moise can be reached on (571) 272-3865. The fax phone 
number for the organization where this application or proceeding is assigned is 571- 
273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

/Zachary A Davis/ 
Examiner, Art Unit 2437 



